JIT Spraying Never Dies
JIT%20Spraying%20Never%20Dies%20-%20Bypass%20CFG%20By%20Leveraging%20WARP%20Shader%20JIT%20Spraying
JIT%20Spraying%20Never%20Dies%20-%20Bypass%20CFG%20By%20Leveraging%20WARP%20Shader%20JIT%20Spraying
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
CVE-2016-0193 (jmp)<br />
esi -> Fake vftable<br />
WebGLRenderingContext.drawArrays() -><br />
d3d11!CDevice::CreateRasterizerState<br />
Shellcode<br />
Stack pivot ROP gadget<br />
Shellcode<br />
Shellcode<br />
* Some trick needs to be played to make sure ebx is holding a proper value to avoid crash @ 0x61d703b7.